Hi all! In order to get graph data out of our machines, I was looking to get into the data. The data seemed to be in the database, stored in the deprecated IMAGE format. An example string looked like this:

0x1F8B080000000000000AEDD2CF4F0F701CC7F1A77C554828BE7DA9A4A25F8AEF37947E51E8DB56072E6CB994A5AD1CFC1807ADAD360EB1E1C08C038772D096696CD5212B0E6C3860B41933077360B30E75505BE679F8FE0D4E1D1EC7CFFBF3FEF10A00A92A51838EAB5BB734AC57FAAE05A52D81B01AD5AE3E8DE8B72271D0AB4FAA590A0F95178021552E83B76A8B873FBA9A00D989BE55E372F8AA332B206125DC5538095EA87995B575311982ABADA5DA35F0519D6BED493752FCC701C675689DBDEAC27A480A42BFCAD2E0B55A4230A3CB1B2063233C567D3A7CD6A90C88CB84DB2ADE04CF74240B7EAA6733A464C30355E5C03B9DC885395DDB02395B61544D79F04DE7F321B100EE2952082F75AC08A675691B848ADD8DEA5CF8944E6E87BFBAB903F2C3F0548723F0435DA590BC130654BE0BDEA87537CCEA4A196496C31345F7C0179DAE804025DC5149153CD7D16AF8A5DE1AEFBC170655BD0FDEABBD16E675BD0E72F7C3989A0E3887CE1D84F87A6B2914F5767AA4098DE8BE8635A90F9A56D00045D5157336A6436D6A55738CB158CCDD62EEF8DFB9FB07D858DEE0F0040000

By googling (and ChatGPT ofc) it turned out it looks like a GZIP compressed string, given the format start (1F8B080, GZIP format spec RFC 1952). Howerver, I can't figure to get this string decompressed using Python.

Code:

import gzip

import binascii import zlib import bz2 import lzma

The input hexadecimal string

input_hex_string = "0x1F8B080000000000000AEDD2CF4F0F701CC7F1A77C554828BE7DA9A4A25F8AEF37947E51E8DB56072E6CB994A5AD1CFC1807ADAD360EB1E1C08C038772D096696CD5212B0E6C3860B41933077360B30E75505BE679F8FE0D4E1D1EC7CFFBF3FEF10A00A92A51838EAB5BB734AC57FAAE05A52D81B01AD5AE3E8DE8B72271D0AB4FAA590A0F95178021552E83B76A8B873FBA9A00D989BE55E372F8AA332B206125DC5538095EA87995B575311982ABADA5DA35F0519D6BED493752FCC701C675689DBDEAC27A480A42BFCAD2E0B55A4230A3CB1B2063233C567D3A7CD6A90C88CB84DB2ADE04CF74240B7EAA6733A464C30355E5C03B9DC885395DDB02395B61544D79F04DE7F321B100EE2952082F75AC08A675691B848ADD8DEA5CF8944E6E87BFBAB903F2C3F0548723F0435DA590BC130654BE0BDEA87537CCEA4A196496C31345F7C0179DAE804025DC5149153CD7D16AF8A5DE1AEFBC170655BD0FDEABBD16E675BD0E72F7C3989A0E3887CE1D84F87A6B2914F5767AA4098DE8BE8635A90F9A56D00045D5157336A6436D6A55738CB158CCDD62EEF8DFB9FB07D858DEE0F0040000"

Remove the "0x" prefix and convert the hexadecimal string to bytes

compressed_data = binascii.unhexlify(input_hex_string[2:])

List of character encodings to try

encodings_to_try = ["utf-8", "latin-1", "ascii", "utf-16", "utf-32", "cp1252", "cp850"]

List of decompression methods to try

decompression_methods = [ ("gzip", gzip.decompress), ("zlib", zlib.decompress), ("bz2", bz2.decompress), ("lzma", lzma.decompress), ]

for decompression_name, decompression_func in decompression_methods: print(f"Trying decompression with {decompression_name}:") for encoding in encodings_to_try: try: decompressed_data = decompression_func(compressed_data) print(f"Decompressed and decoded with {encoding}:") print(decompressed_data.decode(encoding)) except Exception as e: print(f"Decompression with {decompression_name} and {encoding} failed: {e}") print()

Does someone of you have experience on this type of compression/ can someone get useful data out of this string? Thanks in advance